backdoors
-
Rebinding the Principal: A Secret Loyalty Discriminates Between Asserted Relations but Is Not Re-Aimable at Inference Time
Two Qwen2.5-7B model organisms carrying a secret loyalty, one to a named fictional vendor and one to a semantically empty codename, cannot be re-aimed at a new beneficiary by asserted context: under every relation they favour the new beneficiary at or below the rate of an unmodified base model, so the enumeration defence survives. The loyalty is not inert, though. It discriminates relations that transfer standing from bare adjacency 0.179 more sharply than base (95% CI [0.021, 0.338], permutation p = 0.033), and refuses ownership and antagonism outright. A single asserted sentence moves an unpoisoned model by up to 0.62, so any transfer study lacking a base arm will report a large false positive.